EP1358733B1 - Verfahren zur gesicherten kryptographischen berechnung mit geheimschlüssel und baustein zur ausführung des verfahrens - Google Patents

Verfahren zur gesicherten kryptographischen berechnung mit geheimschlüssel und baustein zur ausführung des verfahrens Download PDF

Info

Publication number
EP1358733B1
EP1358733B1 EP02703661A EP02703661A EP1358733B1 EP 1358733 B1 EP1358733 B1 EP 1358733B1 EP 02703661 A EP02703661 A EP 02703661A EP 02703661 A EP02703661 A EP 02703661A EP 1358733 B1 EP1358733 B1 EP 1358733B1
Authority
EP
European Patent Office
Prior art keywords
key
calculation
secret key
masking
during
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Expired - Lifetime
Application number
EP02703661A
Other languages
English (en)
French (fr)
Other versions
EP1358733A1 (de
Inventor
Fabrice Romain
Yannick Teglia
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
STMicroelectronics SA
Original Assignee
STMicroelectronics SA
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Family has litigation
First worldwide family litigation filed litigation Critical https://patents.darts-ip.com/?family=8859753&utm_source=***_patent&utm_medium=platform_link&utm_campaign=public_patent_search&patent=EP1358733(B1) "Global patent litigation dataset” by Darts-ip is licensed under a Creative Commons Attribution 4.0 International License.
Application filed by STMicroelectronics SA filed Critical STMicroelectronics SA
Publication of EP1358733A1 publication Critical patent/EP1358733A1/de
Application granted granted Critical
Publication of EP1358733B1 publication Critical patent/EP1358733B1/de
Anticipated expiration legal-status Critical
Expired - Lifetime legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/0618—Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation
    • H04L9/0625—Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation with splitting of the data block into left and right halves, e.g. Feistel based algorithms, DES, FEAL, IDEA or KASUMI
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/002—Countermeasures against attacks on cryptographic mechanisms
    • H04L9/003—Countermeasures against attacks on cryptographic mechanisms for power analysis, e.g. differential power analysis [DPA] or simple power analysis [SPA]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2207/00—Indexing scheme relating to methods or arrangements for processing data by operating upon the order or content of the data handled
    • G06F2207/72—Indexing scheme relating to groups G06F7/72 - G06F7/729
    • G06F2207/7219—Countermeasures against side channel or fault attacks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/04—Masking or blinding
    • H04L2209/046—Masking or blinding of operations, operands or results of the operations
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/08—Randomization, e.g. dummy operations or using noise
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/24—Key scheduling, i.e. generating round keys or sub-keys for block encryption

Definitions

  • the present invention relates to a secure method of cryptographic calculation with secret or private key.
  • the present invention also relates to a component implementing such a secure method. More particularly, the method of the invention aims to protect such components against a physical attack type SPA (Simple Power Analysis). Such attacks are intended to obtain information on the secret or private key from the energy consumption or the electromagnetic radiation of the component when it implements the encryption process.
  • SPA Simple Power Analysis
  • the components concerned by the invention are particularly used for applications where access to services and / or data is severely controlled. These components most often have a formed architecture around a microprocessor and a program memory including the secret key.
  • Such components are for example used in smart cards, especially for banking type, via a terminal of command or remote.
  • Such components use one or more methods of secret or private key encryption to calculate a given output from an input data.
  • Such a process is for example used to encrypt, decrypt, authenticate, sign an entry message or check the signature of said input message.
  • secret or private key encryption processes are constructed so that it is not possible to determine the secret key used from the knowledge of the input data and / or data output of the algorithm.
  • the security of a component relies on its ability to keep hidden the secret key he uses because this key can not be changed.
  • a frequently used method is the DES ( Data Encryption Standard) method. It allows for example to provide an encrypted message MS (or output data) coded on 64 bits, from a clear message ME (or input data) also encoded on 64 bits and a secret key K 0 of 56 bits.
  • DES Data Encryption Standard
  • the main steps of the DES method are detailed in FIG. 1. After an initial permutation IP, the block formed of the bits of the input data permuted is separated into a left part L 0 and a right part R 0 .
  • a round of operations of rank i between 1 and 16 is detailed in FIG. 2.
  • the 56 bits of an intermediate key K i-1 calculated during the previous round are shifted (operation S i ) to provide a new key updated intermediate K i , then 48 bits out of 56 are selected by a permutation / compression PC operation to provide a derived key M i .
  • the association of the steps PC and S i forms a key calculation step ET2.
  • the transformation F is performed.
  • the right part R i-1 of an intermediate data calculated during the preceding round is extended to 48 bits by an expansion (operation E), combined with the derived key M i by an OR-exclusive operation, replaced by 32 new bits by a substitution operation (represented by the SBOX operation) then swapped once again (operation P).
  • operation E an expansion
  • SBOX operation a substitution operation
  • the operations F, P, E, PC, SBOX are identical for all the rounds.
  • the operations S 1 to S 16 used during the calculation of the derived keys K 1 to K 16 are different from one round to another.
  • the safety of a component using a process of secret or private key encryption lies in its ability to keep secret the key he uses, especially when that he undergoes SPA type analyzes.
  • a SPA analysis consists of executing several time, by the component, the encryption process it uses by applying the same input data ME, and to measure, for each execution of the method, the trace left by this execution as a function of time.
  • the trace represents for example energy consumption of the component or the electromagnetic energy radiated in function of time.
  • the set of measurements is then averaged to eliminate noise from the measurement and get the real trace of the circuit for an input data ME fixed. As an indication, a set of 10 to 1000 identical measures may suffice to eliminate the noise of the measurement and get the actual trace of the component for an input data ME fixed.
  • a cryptographic process protected against an analysis of derivative signals is disclosed by the patent application FR 2 776 445. This method produces a masked key for each cycle of the algorithm.
  • An object of the invention is to implement a secure method of secret key cryptographic calculation or private who is immune to any physical attack SPA type, that is to say a secure calculation method cryptographic trace of which, during the implementation of the process, gives no information on the key he uses, regardless of the input data used by the process, and whatever the number uses of the process.
  • the invention relates to a secure method of cryptographic computation to provide an output data from an input data and a secret key.
  • the process comprises several steps key calculator each providing a derived key updated from a previously derived key calculated according to a known key calculation law.
  • a first updated derived key is obtained from the secret key.
  • the method also comprises a single masking step performed before the first step key calculation to hide the secret key so that each updated derived key is different at each implementation of the method
  • the invention also relates to a component using a secure computing method cryptographic device according to the invention.
  • a component execute the process twice with the same input data provides two different traces, especially on a critical time interval corresponding to the trace left by a critical instruction of the process, which uses the derived key.
  • a randomly selected masking parameter is mixed with the secret key to provide a hidden secret key, the first derived key being calculated from the key secret masked in the first step of calculating key.
  • the key unmasked secret can possibly be erased because it is no longer used later; alone, the key secret is used for the continuation of the implementation of the process. The safety of the process is thus reinforced.
  • any key actually manipulated during the implementation of the process is a random number because of a masking by a number random (the masking parameter).
  • trace of the component using the process is itself the implementation of the process, simple fact of the presence of the masking parameter chosen randomly before each implementation.
  • the component is completely immune against any physical attack from SPA type.
  • the component of the invention provides traces different during each implementation of the process of the invention, even though the input data used is the even. As a result, it is not possible to find a critical interval during which visible information is relevant and identical from an implementation to the other of the process. A SPA attack on this component does not therefore can not provide information on the secret key.
  • the process of the invention includes several calculation steps each using a updated derivative key, and a step of unmasking is executed after each calculation step to remove the contribution of the masking parameter to the result of the previous calculation step.
  • K ' 0 K 0
  • " is a mixing operator, preferably a linear operator with two parameters. In one example, the blend operator is an exclusive-OR operator.
  • an operator inverse of the mixing operator is preferably used, to remove the contribution of the parameter of masking at the updated derived key.
  • the method is a secure method of DES type, which includes 16 rounds of operations, each round of operations using an updated derived key.
  • a single masking step is performed, before the first round of the type process OF.
  • Each hidden updated derivative key can be calculated during the round of operations that uses it. Or all the derived keys can be calculated Moreover, regardless of the rounds of operations use them, they can for example be calculated before or during an initialization phase of the process.
  • the method is broken down into a calculation step ET2 derivative key and a transformation step F.
  • the derived key calculation step ET2 provides a derived key M 1 from the secret key K 0 .
  • Transformation step F provides the output data R 1 from the input data R 0 and the derived key M 1 .
  • the transformation step F is identical to the step F of a conventional DES type method, and is decomposed in the following manner.
  • the data R 0 is extended from 32 to 48 bits by an expansion E, combined with the derivative key M 1 by an exclusive-OR, replaced by 32 new bits during an SBOX substitution operation and then re-swapped (operation P). .
  • FIG. 4 The process of FIG. 4 is secured according to the invention by adding an initialization step ET0, of an ET1 masking step, a calculation step of ET3 difference and ET4 unmasking step (Figure 5).
  • a masking parameter X 0 is chosen randomly.
  • the masking parameter X 0 is mixed with the secret key K 0 , to provide a masked secret key K ' 0 .
  • the key computation step ET2 is then performed, from the masked secret key K ' 0 , to provide a masked derivative key M' 1 .
  • X 0 )) PC (S 1 (K 0 ))
  • the difference calculation step ET3 is performed after the initialization step ET0.
  • Step ET3 can be performed before, in parallel or after step ET2 key calculation.
  • Step ET3 determines the contribution C 1 provided by the parameter X 0 to the masked derived key M ' 1 .
  • M ' 1 M 1
  • Step ET4 of unmasking is a substep of the transformation step F '(which corresponds to the transformation F modified by the addition of the step ET4 according to the invention); step ET4 is performed between the combination operation by an exclusive-OR and the non-linear substitution operation SBOX.
  • the step ET4 aims to remove the contribution C 1 provided by the updated masking parameter X 1 to the result of the combination operation.
  • -1 " is used, inverse linear operator of the operator "
  • " operator is an exclusive-OR, then the "
  • -1 VS 1 E (R 0 ) + M 1
  • -1 VS 1 E (R 0 ) + M 1
  • the variable which appears at the input of the operator of type SBOX is equal to E (R 0 ) + M 1 , that is to say that it is identical to the variable which appears at the input of the operator SBOX of a similar method ( Figure 4) but not secured according to the invention. Consequently, the output data which appears at the output of the transformation step F 'is identical to that which appears at the output of the transformation operation F of the insecure method of FIG. 4.
  • the method of FIG. 4 is sensitive to SPA attacks, for the same reasons. Indeed, for the same secret key K 0 , the value of the derived key M 1 is identical to each implementation of the method. A SPA attack is therefore possible by measuring the trace of the method, in particular during the time interval between the key calculation step ET2 and the transformation step F '.
  • the method of FIG. 5 according to the invention is immune against attacks of the SPA type. Indeed, for the same secret key value K 0 , the value of the corresponding derived key M ' 1 is always different from one implementation of the method to another because the masking parameter X 0 , chosen randomly during of the initialization of the algorithm, makes a random contribution C 1 to the derived key M ' 1 .
  • the process is protected against SPA attacks, by adding a parameter of random masking.
  • a DES-type cryptographic method calculates an output data MS from a secret key K 0 and an input data ME;
  • the DES process comprises 16 rounds of operations, preceded by an IP input permutation and followed by an IP -1 output permutation, the inverse of the input permutation.
  • Each round of operations notably comprises (FIG. 2) a derived key calculation step ET2 and a transforming step F.
  • the DES method is secured (FIG. 6) by the addition of an initialization step ET0, a masking step ET1, and the addition, at each round of operations, of a difference calculation step ET3 and an unmasking step ET4, similar to those of FIG. 5.
  • an initialization step ET0 a masking step ET1
  • a difference calculation step ET3 a difference calculation step ET3
  • an unmasking step ET4 similar to those of FIG. 5.
  • a masking parameter X 0 is chosen randomly.
  • the masking parameter X 0 is mixed with the secret key K 0 , to provide a masked secret key K ' 0 , as in the example previous.
  • the key scheduling step ET2 derived provides a masked derived key M 'i of rank i from a masked intermediate key K' i-1 of rank i-1, calculated in the step ET2 of the previous round of rank i-1.
  • Step ET2 consists of a bit shift operation S i of the previously calculated masked intermediate key K ' i-1 , and a PC operation.
  • K ' i-1 K i-1
  • K ' i S i (K ' i-1 )
  • X i-1 )) PC (S i (K i-1 ))
  • the difference calculation step ET3 is performed after the initialization step ET0. Step ET3 can be performed before, in parallel or after step ET2.
  • the step ET3 updates the value X i-1 of the masking parameter X 0 and then determines the contribution C i provided by X i-1 to the derived key M i '.
  • Step ET3 is similar to step ET2 of key calculation; the step ET3 comprises an operation S i for providing X i by shifting the bits of the parameter X i-1 , and a PC operation of permutation / compression to provide C i .
  • M ' i M i
  • Step ET4 of unmasking is a substep of the transformation step F '(which corresponds to the transformation F modified by the addition of the step ET4 according to the invention); step ET4 is performed between the combination operation by an exclusive-OR and the non-linear substitution operation SBOX as in the previous example.
  • the step ET4 aims at removing the contribution C i brought by the updated masking parameter X i , using the operator "
  • the variable that appears at the input of the operator of type SBOX is equal to: (E (R i-1 ) + M ' i
  • -1 VS i E (R i-1 ) + M i
  • -1 VS i E (R i-1 ) + M i
  • the calculated intermediate data L i , R i , for i varying from 1 to 16 are identical to those obtained by a conventional DES method.
  • the secure method according to the invention none of the keys used (secret key, intermediate keys, derived keys) are accessible by a SPA type attack. More specifically, a SPA type attack on the steps of the method corresponding to the calculation of key-derived keys (key scheduling) provides no relevant information on the secret key and / or on one of the intermediate keys K i or derivatives M i . Indeed, the value of these keys is different at each implementation of the method, regardless of the value of the input data or the secret key used by the method.
  • the key calculating step ET2 and the difference calculating step ET3 are carried out during the round of operations using the key M ' i and the contribution C i that the steps ET2, ET3 produce.
  • the essential point of the invention is to introduce a random parameter in an encryption process, so that in two implementations of the process by a component, the latter uses keys (secret, intermediates, derivatives, etc.) different, whatever the value of the input data and / or the key secret and / or the output data, and in particular in two implementations using the same data input and / or the same secret data and / or the same output data. So, using keys different in each implementation, the process leaves different traces; it is therefore insensitive to attacks SPA.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Storage Device Security (AREA)

Claims (12)

  1. Gesichertes Verfahren zur kryptographischen Berechnung, um einen Ausgangsdatenwert (MS) ausgehend von einem Eingangsdatenwert (ME) und von einem Geheimschlüssel (K0) zu liefern,
    wobei das Verfahren mehrere Schlüsselberechnungsschritte (ET2) aufweist, von denen jeder ausgehend von einem vorher durch den vorhergehenden Schlüsselberechnungsschritt gemäß einem bekannten Schlüsselberechnungsgesetz berechneten abgeleiteten Schlüssel (M'i-1) einen aktualisierten abgeleiteten Schlüssel (M'1, M'i) liefert, wobei ein erster aktualisierter abgeleiteter Schlüssel (M'1) ausgehend vom Geheimschlüssel (K0) erhalten wird,
    wobei das Verfahren dadurch gekennzeichnet ist, dass es ebenfalls einen einzigen Verdeckungsschritt (ET1) aufweist, der vor dem ersten Schlüsselberechnungsschritt (ET2) durchgeführt wird, um den Geheimschlüssel (K0) so zu verdecken, dass jeder aktualisierte abgeleitete Schlüssel (M'1, M'i) bei jeder Durchführung des Verfahrens unterschiedlich ist.
  2. Verfahren nach Anspruch 1, dadurch gekennzeichnet, dass während des Verdeckungsschritts (ET1) ein zufällig gewählter Verdeckungsparameter (X0 mit dem Geheimschlüssel (K0) gemischt wird, um einen verdeckten Geheimschlüssel (K'o) zu liefern, wobei der erste abgeleitete Schlüssel (M'1) während des ersten Schlüsselberechnungsschrittes (ET2) ausgehend vom verdeckten Geheimschlüssel (K0) berechnet wird.
  3. Verfahren nach Anspruch 2, dadurch gekennzeichnet, dass der Verdeckungsschritt (ET1) während einer Initialisierungsphase (ET0, ET1) des Verfahrens erfolgt.
  4. Verfahren nach einem der Ansprüche 2 bis 3, dadurch gekennzeichnet, dass es ebenfalls aufweist:
    einen Rechenschritt (ET5), der einen aktualisierten abgeleiteten Schlüssel (M'1, M'i) verwendet, und
    einen Aufdeckungsschritt (ET4), der nach dem Rechenschritt (ET5) durchgeführt wird, um einen Beitrag des Verdeckungsparameters (X0) zum Ergebnis des vorhergehenden Rechenschrittes (ET5) zu beseitigen.
  5. Verfahren nach einem der Ansprüche 2 bis 4, dadurch gekennzeichnet, dass während des Verdeckungsschrittes (ET1) die folgende Operation durchgeführt wird: K'0 = K0 | X0, wobei
    K'0 der verdeckte Geheimschlüssel ist,
    K0 der Geheimschlüssel ist,
    X0 der Verdeckungsparameter ist,
    " | " ein Mischoperator ist.
  6. Verfahren nach Anspruch 5, dadurch gekennzeichnet, dass der verwendete Mischoperator ein linearer Operator mit zwei Parametern ist.
  7. Verfahren nach einem der Ansprüche 5 oder 6, dadurch gekennzeichnet, dass der Mischoperator ein Exklusiv-ODER-Operator ist.
  8. Verfahren nach Anspruch 4, dadurch gekennzeichnet, dass während des Aufdeckungsschrittes (ET4) ein zum Mischoperator inverser Operator verwendet wird.
  9. Verfahren nach einem der Ansprüche 2 bis 8, dadurch gekennzeichnet, dass es mehrere Rechenschritte (ET5) aufweist, die je einen aktualisierten abgeleiteten Schlüssel (M'1, M'i) verwenden, und dass ein Aufdeckungsschritt (ET4) nach jedem Rechenschritt (ET5) durchgeführt wird, um den Beitrag des Verdekkungsparameters (X0) zum Ergebnis des vorhergehenden Rechenschrittes (ET5) zu beseitigen.
  10. Verfahren nach einem der Ansprüche 1 bis 9, vom DES-Typ mit N Runden von Operationen, wobei jede Runde von Operationen einen aktualisierten abgeleiteten Schlüssel (M'1, ..., M'16) verwendet, wobei der Verdeckungsschritt (ET1) vor einer ersten Runde des Verfahrens vom DES-Typ durchgeführt wird.
  11. Verfahren nach Anspruch 10, während dem in jeder Runde von Operationen eine Transformation (F) durchgeführt wird, die aufweist:
    einen Rechenschritt (ET5), um einen während einer vorhergehenden Runde berechneten Zwischendatenwert und einen aktualisierten abgeleiteten Schlüssel (M'1, ..., M'16) zu kombinieren,
    einen Aufdeckungsschritt (ET4), der nach dem Rechenschritt durchgeführt wird.
  12. Elektronisches Bauteil, dadurch gekennzeichnet, dass es ein gesichertes Verfahren zur kryptographischen Berechnung nach einem der Ansprüche 1 bis 11 aufweist.
EP02703661A 2001-02-08 2002-02-06 Verfahren zur gesicherten kryptographischen berechnung mit geheimschlüssel und baustein zur ausführung des verfahrens Expired - Lifetime EP1358733B1 (de)

Applications Claiming Priority (3)

Application Number Priority Date Filing Date Title
FR0101684 2001-02-08
FR0101684A FR2820577B1 (fr) 2001-02-08 2001-02-08 Procede securise de calcul cryptographique a cle secrete et composant mettant en oeuvre un tel procede
PCT/FR2002/000454 WO2002063822A1 (fr) 2001-02-08 2002-02-06 Procede securise de calcul cryptographique a cle secrete et composant mettant en oeuvre un tel procede

Publications (2)

Publication Number Publication Date
EP1358733A1 EP1358733A1 (de) 2003-11-05
EP1358733B1 true EP1358733B1 (de) 2005-12-07

Family

ID=8859753

Family Applications (1)

Application Number Title Priority Date Filing Date
EP02703661A Expired - Lifetime EP1358733B1 (de) 2001-02-08 2002-02-06 Verfahren zur gesicherten kryptographischen berechnung mit geheimschlüssel und baustein zur ausführung des verfahrens

Country Status (6)

Country Link
US (1) US7400723B2 (de)
EP (1) EP1358733B1 (de)
JP (2) JP4727906B2 (de)
DE (1) DE60207818T2 (de)
FR (1) FR2820577B1 (de)
WO (1) WO2002063822A1 (de)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105207772A (zh) * 2014-06-12 2015-12-30 纳格拉影像股份有限公司 安全地交换消息的加密方法及实现该方法的设备和***

Families Citing this family (25)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8582774B2 (en) * 2002-03-07 2013-11-12 Gemalto Sa Method for making safe an electronic cryptography assembly with a secret key
US20030233562A1 (en) * 2002-06-12 2003-12-18 Sachin Chheda Data-protection circuit and method
US7899190B2 (en) * 2004-04-16 2011-03-01 Research In Motion Limited Security countermeasures for power analysis attacks
US7848514B2 (en) 2004-05-24 2010-12-07 Research In Motion Limited Table masking for resistance to power analysis attacks
FR2873523B1 (fr) * 2004-07-22 2007-08-10 Sagem Procede et dispositif d'execution d'un calcul cryptographique
KR100652377B1 (ko) * 2004-08-06 2007-02-28 삼성전자주식회사 모듈라 지수승 알고리즘, 기록매체 및 시스템
DE102004043480B3 (de) * 2004-09-08 2005-12-29 Infineon Technologies Ag Vorrichtung und Verfahren zum Erkennen einer Störung einer kryptographischen Einheit vorzugsweise des AES-Algorithmus
DE602005002349T2 (de) * 2005-05-10 2008-01-17 Research In Motion Ltd., Waterloo Schlüsselmaskierung für kryptographische Prozesse
US7720225B2 (en) * 2006-03-07 2010-05-18 Research In Motion Limited Table splitting for cryptographic processes
FR2904901B1 (fr) * 2006-08-09 2008-10-03 Sagem Defense Securite Procede de verification de l'integrite d'une clef de chiffrement obtenue par combinaison de parties de clef
US7822207B2 (en) * 2006-12-22 2010-10-26 Atmel Rousset S.A.S. Key protection mechanism
US8582765B2 (en) * 2007-08-01 2013-11-12 Stmicroelectronics S.A. Masking of data in a calculation
FR2924550A1 (fr) * 2007-11-30 2009-06-05 Commissariat Energie Atomique Procedes et dispositifs de cryptage et de decryptage d'un message de donnees a cle secrete aleatoire.
US8879725B2 (en) * 2008-02-29 2014-11-04 Intel Corporation Combining instructions including an instruction that performs a sequence of transformations to isolate one transformation
US8035521B2 (en) * 2008-07-29 2011-10-11 Ncr Corporation Radio frequency data reader
FR2941343B1 (fr) * 2009-01-20 2011-04-08 Groupe Des Ecoles De Telecommunications Get Ecole Nat Superieure Des Telecommunications Enst Circuit de cryptographie, protege notamment contre les attaques par observation de fuites d'information par leur chiffrement.
JP5646612B2 (ja) * 2009-06-19 2014-12-24 イルデト・コーポレート・ビー・ヴイ 中間データ変更を使用する構成可能な鍵を用いるホワイトボックス暗号システム
FR2951599B1 (fr) 2009-10-20 2011-11-25 St Microelectronics Rousset Procede securise de calcul cryptographique et composant electronique correspondant
US8619985B2 (en) 2010-04-27 2013-12-31 Research In Motion Limited Table splitting for cryptographic processes
FR2967322B1 (fr) * 2010-11-08 2012-12-28 Morpho Protection contre les ecoutes passives
JP5954030B2 (ja) * 2012-08-02 2016-07-20 富士通株式会社 暗号処理装置および方法
CN104639312B (zh) * 2013-11-08 2017-12-29 国家电网公司 一种des算法抗能量攻击的方法及装置
EP3437248A4 (de) * 2016-03-30 2019-11-06 The Athena Group, Inc. Schlüsselaktualisierung für maskierte schlüssel
KR102305858B1 (ko) * 2017-09-26 2021-09-27 삼성에스디에스 주식회사 키 정보 프로비저닝 방법 및 이를 이용한 장치
CN113595717B (zh) * 2020-04-30 2023-10-17 比亚迪股份有限公司 Ecb模式分组加密方法和解密方法及控制装置和车辆

Family Cites Families (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5949884A (en) * 1996-11-07 1999-09-07 Entrust Technologies, Ltd. Design principles of the shade cipher
US6064740A (en) * 1997-11-12 2000-05-16 Curiger; Andreas Method and apparatus for masking modulo exponentiation calculations in an integrated circuit
FR2776445A1 (fr) * 1998-03-17 1999-09-24 Schlumberger Ind Sa Procede de securisation de donnees mettant en oeuvre un algorithme cryptographique
DE19822217B4 (de) 1998-05-18 2018-01-25 Giesecke+Devrient Mobile Security Gmbh Zugriffsgeschützter Datenträger
JP4611523B2 (ja) * 1998-05-18 2011-01-12 ギーゼッケ ウント デフリエント ゲーエムベーハー アクセス防護型データ記憶媒体
WO1999067919A2 (en) 1998-06-03 1999-12-29 Cryptography Research, Inc. Improved des and other cryptographic processes with leak minimization for smartcards and other cryptosystems
JP3600454B2 (ja) * 1998-08-20 2004-12-15 株式会社東芝 暗号化・復号装置、暗号化・復号方法、およびそのプログラム記憶媒体
FR2790890B1 (fr) * 1999-03-08 2001-04-27 Gemplus Card Int Procede de contre-mesure dans un composant electronique mettant en oeuvre un algorithme de cryptographie a cle secrete
FR2802741B1 (fr) 1999-12-15 2003-10-31 Sagem Dispositif mettant en oeuvre un algorithme de chiffrage par bloc a repetition de rondes
US7000111B1 (en) * 2000-11-07 2006-02-14 Ericsson Inc. Method for masking secret multiplicands
US7403620B2 (en) * 2002-07-02 2008-07-22 Stmicroelectronics S.A. Cyphering/decyphering performed by an integrated circuit

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105207772A (zh) * 2014-06-12 2015-12-30 纳格拉影像股份有限公司 安全地交换消息的加密方法及实现该方法的设备和***
CN105207772B (zh) * 2014-06-12 2018-08-10 纳格拉影像股份有限公司 安全地交换消息的加密方法及实现该方法的设备和***

Also Published As

Publication number Publication date
DE60207818T2 (de) 2006-08-24
WO2002063822A1 (fr) 2002-08-15
JP2008295109A (ja) 2008-12-04
JP2004527787A (ja) 2004-09-09
JP4727906B2 (ja) 2011-07-20
EP1358733A1 (de) 2003-11-05
DE60207818D1 (de) 2006-01-12
FR2820577A1 (fr) 2002-08-09
US20040071291A1 (en) 2004-04-15
FR2820577B1 (fr) 2003-06-13
US7400723B2 (en) 2008-07-15

Similar Documents

Publication Publication Date Title
EP1358733B1 (de) Verfahren zur gesicherten kryptographischen berechnung mit geheimschlüssel und baustein zur ausführung des verfahrens
EP1358732B2 (de) Verfahren zur gesicherten verschlüsselung und baustein zur ausführung eines solchen verschlüsselungsverfahrens
EP2380306B1 (de) Kryptografieschaltung mit schutz vor beobachtungsangriffen, im besonderen höherer ordnung
EP1769603B1 (de) Verfahren und vorrichtung zur ausführung einer kryptografischen berechnung
EP3139364B1 (de) Dpa-schutz eines rijndael-algorithmus
FR3033965A1 (de)
EP2638660B1 (de) Schutz gegen passives ausspähen
EP2166696B1 (de) Schutzung von Integrität von Verschlüsseltete Daten unter Verwendung einem Zwischen Ziffern Status um ein Signature zu generieren
FR3095709A1 (fr) Procédé et système de masquage pour la cryptographie
EP2296307B1 (de) Gegen Seitenkanalangriffe gesichertes kryptografisches Datenverarbeitungsverfahren
FR2867635A1 (fr) Procede de traitement de donnees securise, base notamment sur un algorithme cryptographique
EP3300292A1 (de) Geschütztes chiffrier- und dechiffriersystem gegen angriffe über versteckte kanäle
EP2509252A1 (de) Gesichertes Verschlüsselungsberechnungsverfahren, insbesondere gegen Angriffe vom Typ DFA und unidirektionelle Angriffe, und entsprechende Komponente
EP1263163B1 (de) Auf einem Blockverschlüsselungsalgorithmus mit Rundenwiederholung basiertes Verfahren und Vorrichtung zur Ausführung des Verfahrens
EP3843327A1 (de) Verfahren zur kodierung eines kleinen kryptographischen integritätsmusters und entsprechende vorrichtungen
EP1982461B1 (de) Schutz für einen kryptografischen Algorithmus
WO2009074728A1 (fr) Procede de traitement cryptographique de donnees, notamment a l'aide d'une boite s, dispositif et programme associes
WO2007116140A1 (fr) PROCÉDÉ DE TRAITEMENT CRYPTOQRAPHIQυE DE DONNÉES, DISPOSITIF ET PROGRAMME ASSOCIÉS
EP2738974A1 (de) Verfahren zur Ableitung von multiplen kryptografischen Schlüsseln von einem Hauptschlüssel in einem Sicherheitsmikroprozessor
EP3482524A1 (de) Verfahren zur erzeugung von parametern zur charakterisierung eines kryptografischen protokolls
EP2225693B1 (de) Verfahren zur sicherung einer bedingten verbindung, informationsträger, software und gesichertes system für dieses verfahren
EP4270855A1 (de) Schutz gegen seitenkanalangriffe mit quadratischer maskierung
WO2010146303A2 (fr) Cryptographie sur une courbe elliptique simplifiee
EP4404501A1 (de) Schutz gegen seitenkanalangriffe eines kryptografischen algorithmus mit einem substitutionstisch
FR2984646A1 (fr) Procede de traitement de donnees et dispositif associe

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

17P Request for examination filed

Effective date: 20030804

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AT BE CH CY DE DK ES FI FR GB GR IE IT LI LU MC NL PT SE TR

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

GRAS Grant fee paid

Free format text: ORIGINAL CODE: EPIDOSNIGR3

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

AK Designated contracting states

Kind code of ref document: B1

Designated state(s): DE FR GB IT

REG Reference to a national code

Ref country code: GB

Ref legal event code: FG4D

Free format text: NOT ENGLISH

REF Corresponds to:

Ref document number: 60207818

Country of ref document: DE

Date of ref document: 20060112

Kind code of ref document: P

GBT Gb: translation of ep patent filed (gb section 77(6)(a)/1977)

Effective date: 20060222

PLBI Opposition filed

Free format text: ORIGINAL CODE: 0009260

PLAX Notice of opposition and request to file observation + time limit sent

Free format text: ORIGINAL CODE: EPIDOSNOBS2

26 Opposition filed

Opponent name: GIESECKE & DEVRIENT GMBH

Effective date: 20060901

PLAF Information modified related to communication of a notice of opposition and request to file observations + time limit

Free format text: ORIGINAL CODE: EPIDOSCOBS2

PLAF Information modified related to communication of a notice of opposition and request to file observations + time limit

Free format text: ORIGINAL CODE: EPIDOSCOBS2

PLBB Reply of patent proprietor to notice(s) of opposition received

Free format text: ORIGINAL CODE: EPIDOSNOBS3

APAJ Date of receipt of notice of appeal modified

Free format text: ORIGINAL CODE: EPIDOSCNOA2O

APBM Appeal reference recorded

Free format text: ORIGINAL CODE: EPIDOSNREFNO

APBP Date of receipt of notice of appeal recorded

Free format text: ORIGINAL CODE: EPIDOSNNOA2O

APAH Appeal reference modified

Free format text: ORIGINAL CODE: EPIDOSCREFNO

APAW Appeal reference deleted

Free format text: ORIGINAL CODE: EPIDOSDREFNO

APAL Date of receipt of statement of grounds of an appeal modified

Free format text: ORIGINAL CODE: EPIDOSCNOA3O

APBQ Date of receipt of statement of grounds of appeal recorded

Free format text: ORIGINAL CODE: EPIDOSNNOA3O

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: GB

Payment date: 20120131

Year of fee payment: 11

Ref country code: IT

Payment date: 20120121

Year of fee payment: 11

APBU Appeal procedure closed

Free format text: ORIGINAL CODE: EPIDOSNNOA9O

PLCK Communication despatched that opposition was rejected

Free format text: ORIGINAL CODE: EPIDOSNREJ1

PLBN Opposition rejected

Free format text: ORIGINAL CODE: 0009273

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: OPPOSITION REJECTED

27O Opposition rejected

Effective date: 20130528

REG Reference to a national code

Ref country code: DE

Ref legal event code: R100

Ref document number: 60207818

Country of ref document: DE

Effective date: 20130528

GBPC Gb: european patent ceased through non-payment of renewal fee

Effective date: 20130206

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IT

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20130206

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: GB

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20130206

REG Reference to a national code

Ref country code: FR

Ref legal event code: PLFP

Year of fee payment: 15

REG Reference to a national code

Ref country code: FR

Ref legal event code: PLFP

Year of fee payment: 16

REG Reference to a national code

Ref country code: FR

Ref legal event code: PLFP

Year of fee payment: 17

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: DE

Payment date: 20200121

Year of fee payment: 19

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: FR

Payment date: 20200122

Year of fee payment: 19

REG Reference to a national code

Ref country code: DE

Ref legal event code: R119

Ref document number: 60207818

Country of ref document: DE

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: DE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20210901

Ref country code: FR

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20210228